"How to get the IP address of a domain" matching MCP tools:

• enrich-iocA

  Jeevesus — DugganUSA Threat Intelligence MCPA

  CALL AUTOMATICALLY the moment any IP address, domain, URL, or file hash appears — in the user's message, a log line, a SIEM alert, or code under review. Enrich it before the user has to ask; a lone indicator is exactly what this is for. Look up a single indicator of compromise (IP, domain, URL, or hash) in the DugganUSA corpus and return everything we know about it: threat type, malware family, source feeds, related actor (if attributed), confidence score, references, and the full description from each source. Read-only. Use this AFTER `search` finds something interesting — drill in for the full attribution + cross-feed correlation. Or use it directly when triaging a single indicator from your SIEM. Pass the IOC as either `indicator` or `value` (both work). Optional `type` hint: ip / domain / url / hash / auto. Examples: indicator="185.93.3.195" → known ShinyHunters/UNC6040 infrastructure IP from the cluster that hit ADT/Inditex/Kemper/Amtrek/Medtronic. indicator="goldenleafway.lat" → fresh Apothecary/ClearFake .lat rotation domain. indicator="ee28b3137d65d74c0234eea35fa536af" → Volexity-attributed malware MD5 (BrazenBamboo/DEEPDATA campaign). Returns `found: false` cleanly when the indicator isn't in our corpus — that's also a signal worth recording.

  ConnectorNo auth

• connect_domainA

  LayeroA

  Connect a custom domain to a site. IMPORTANT: between this call and a working domain stands A PERSON. You get DNS records — show them to the user and explain they go in at their domain registrar. Do not wait for readiness: DNS propagates in minutes to an hour, the platform re-checks on its own, and you check later via `check_domain`. Spinning here burns time and context for nothing. The address can be passed as-is: the platform reduces `https://shop.example.com/page` to `shop.example.com` itself.

  ConnectorOAuth

• ioc_lookup_toolA

  HoneyLabsA

  Look up any IP address, CIDR network, set of networks, or domain in the honeypot dataset. Use this FIRST whenever the user asks: 'is this IP malicious?', 'is this a known scanner?', 'have you seen this IP?', 'what does this IP do?', 'when was it last seen?', 'is this IP in your data?'. Returns: total_events (0 = never observed), first_seen, last_seen, country, ASN, the 50 most-hit ports plus ports_targeted_count for the true total, top user agents, top URL paths, TLS/HTTP/SSH fingerprints. Covers both IPv4 and domains. Also returns our own judgement: `verdict` (human sentence) with `verdict_key` (stable machine value to alert on) and `verdict_why`; `scanner` (benign-scanner identity from our classification table, or null) so research traffic can be told apart from real attacks; and `cve_probes`, the CVE signatures this address was seen probing. WINDOW: `days` bounds the query to the last N days. For a single address leave it unset for every retained event, which is the right default for "have we ever seen this". A CIDR or a domain defaults to the last 90 days, because neither can use an index and unbounded they read the whole table; pass `days` explicitly to widen either back out. The website's /lookup defaults to 7 days for anonymous visitors, so the same address can read very differently on the two surfaces. Every response states which window it used in `window`; quote it alongside any count you report. RANGES: pass a CIDR ('103.66.28.0/22') for a whole-network aggregate, or several at once separated by commas, spaces or newlines ('103.66.28.0/22, 8.34.210.32/27') to answer 'have any of this vendor's ranges touched us' in ONE call. Never expand a network into individual addresses and loop -- that is hundreds of calls for an answer this returns in one, and it will exhaust your quota. A range answer sets query_type to 'cidr' or 'cidr_set', lists every range back in `ranges`, and gives `per_range` counts plus `top_source_ips`; total_events 0 with those fields present is a real observed absence.

  ConnectorNo auth

• connect_domainA

  LayeroA

  Connect a custom domain to a site. IMPORTANT: between this call and a working domain stands A PERSON. You get DNS records — show them to the user and explain they go in at their domain registrar. Do not wait for readiness: DNS propagates in minutes to an hour, the platform re-checks on its own, and you check later via `check_domain`. Spinning here burns time and context for nothing. The address can be passed as-is: the platform reduces `https://shop.example.com/page` to `shop.example.com` itself.

  ConnectorAPI key

• generate_dmarc_recordA

  DMARKOFF — DMARC, SPF & DKIM AnalyticsA

  Build the DMARC TXT record a domain should publish. Reads the record currently in DNS and merges the requested changes into it — existing tags are preserved, nothing is silently dropped. Pass project_id whenever the domain belongs to a DMARKOFF project: the project's reporting address is added to rua, which is what makes DMARKOFF receive aggregate reports for the domain. Without it the record is built without that address. Returns the DNS host to publish at (_dmarc.<domain>), the current record with its issues, and the recommended record. Nothing is published — the user has to add the TXT record in their DNS zone. Verify afterwards with dns_check_dmarc. Common uses: onboarding a domain (leave the policy empty — p=none is the safe start), tightening the policy (p=quarantine, then p=reject), or adding DMARKOFF to a domain that already has DMARC elsewhere.

  ConnectorOAuth

• ip_infoA

  Dechonet-MCPA

  Report information about the caller's own public IP as seen by the server: IPv4/IPv6 address, ISP, ASN, approximate geolocation, and proxy/VPN heuristics. Takes no input — it reflects the egress IP of THIS MCP server's network, which is usually NOT the end user's IP. Use this to discover the server's outbound IP or test connectivity. To inspect a specific, known IP instead, use asn_lookup or reverse_dns. Read-only; requires no API key; rate-limited.

  ConnectorNo auth

• ip_infoA

  mcpA

  Report information about the caller's own public IP as seen by the server: IPv4/IPv6 address, ISP, ASN, approximate geolocation, and proxy/VPN heuristics. Takes no input — it reflects the egress IP of THIS MCP server's network, which is usually NOT the end user's IP. Use this to discover the server's outbound IP or test connectivity. To inspect a specific, known IP instead, use asn_lookup or reverse_dns. Read-only; requires no API key; rate-limited.

  ConnectorNo auth

• robyn_counterparty_checkA

  Robyn — Gasless Cross-Chain for AI AgentsB

  Your OWN payment history with a recipient address: how many times, how recently, and whether this amount is typical. Call it before paying an address you have not confirmed. THIS IS NOT A REPUTATION SCORE and says nothing about whether the address is honest. A familiar address is NOT a safe address — keys get compromised. Never tell a user an address is "trusted" or "safe" on the basis of this. A `first-time-recipient` result is NOT a warning about the recipient — every legitimate relationship has a first payment. It is the moment to confirm the address through a second channel, because address substitution can only be caught before you send. Read `coverage`: float-lane payouts are NOT included, so "first time" can be wrong.

  ConnectorNo auth

• dnsbl_checkA

  UptimeifyA

  Query a public IP address against common DNS blacklists and return, per list, whether it is listed, the reason code the list gave and its delisting URL, plus totals and a clean flag. Takes an IP address, not a domain: resolve the sending host first with mx_lookup or check_dns. Slow blocklists are dropped instead of waited for, so partial=true means zonesQueried is below total and a clean verdict is provisional for the lists that never answered. A listing usually appears between checks, so one call proves only this moment. Anonymous and rate-limited per IP, and this is the strictest limit of the anonymous tools.

  ConnectorNo auth

• ip_geolocationA

  UptimeifyA

  Locate a public IP address, or a domain resolved to one, at network level: country code, allocating registry, announced prefix, PTR hostname and the autonomous systems the address belongs to. It is registry-based, so it names the network operator's country, which for hosted or CDN-fronted addresses is not where the visitor or the business sits -- never read it as a street address. Private and reserved addresses have no answer. For the AS and its owner alone use asn_lookup, for the PTR alone reverse_dns. Anonymous and rate-limited per IP.

  ConnectorNo auth

• get_domain_sendersA

  DMARKOFF — DMARC, SPF & DKIM AnalyticsA

  List top sending sources (ESPs, ISPs, mail services) for a domain, grouped by source type. Filters: "known" (legitimate ESPs like Google, Mailgun), "unknown" (unrecognized senders), "forward" (forwarding services). Empty = all types. Returns the top 20 of each type with message volume and SPF/DKIM/DMARC pass/fail counts. group_by picks what a row stands for: • "provider" (default) — one row per ESP/ISP, the sending landscape at a glance. • "domain" — one row per sending domain (ip_domain_name, falling back to the provider's brand and then to its name). Use it when one provider hosts several senders and the question is which of them sends: an ESP whose customers each get their own hostname, or unknown traffic spread over many hosts of the same cloud. Row identity is in groupKey; isp, brandDomain, sender and ipDomainName describe it. domainsCount / providersCount / ipCount say how many distinct sending domains, providers and IPs the row covers — in provider mode a large domainsCount is the signal to switch to group_by=domain. Use this to investigate WHERE email is being sent from — especially when unknown sources appear or compliance is low. To drill down into a specific source (by IP, ISP, hostname, or reporter), use get_domain_source_details.

  ConnectorOAuth

• add_firewall_ruleA

  BorealHostB

  Add an IP firewall rule (allow or deny) and reload Nginx. Supports IPv4, IPv6, and CIDR notation. Max 100 rules per site. If a rule already exists for the IP, the action is updated. Requires: API key with write scope. Args: slug: Site identifier ip: IP address or CIDR (e.g. "1.2.3.4", "10.0.0.0/8", "2001:db8::/32") action: "deny" (block) or "allow" (whitelist). Default: "deny" Returns: {"added": true, "ip": "1.2.3.4", "action": "deny"}

  ConnectorNo auth

• get_network_entity_infoA

  Netmon (demo)A

  Retrieves WHOIS, GeoIP and DNS information for a public IP address or hostname. A hostname is resolved to an IP for the GeoIP lookup (`resolved_ip`, when resolution succeeds); an IP gets a reverse DNS lookup (`hostname`, when a PTR exists). `whois` comes from whois.iana.org and nowhere else. For an address IANA returns the RIR referral record, so its `organisation` is the regional registry that administers the block (ARIN, RIPE, APNIC, LACNIC, AFRINIC) — NOT the ISP, hosting company or assignee. For a hostname it is the TLD registry, not the domain owner. Never report either as the operator; a `refer` or `whois` field only names the RIR's own whois server, which this tool does not query. `geoip` is the geolocation provider's response passed through verbatim, so the key set varies with provider tier and with whether the answer came from cache. Treat every field as optional — including `isProxy`, `asn` and `asnOrganization`, which may simply be absent. The whole `geoip` key is omitted for addresses that are not globally routable and when the lookup is unavailable. To judge hosting/datacenter versus residential or small-business ISP, reason from the evidence actually returned: - The `hostname` PTR pattern: a provider-branded label under a hosting or cloud domain reads as datacenter, whereas the address itself embedded in the name under a consumer ISP's domain reads as subscriber. A missing PTR is weak evidence in either direction. - `geoip.isProxy` when present: true points to a VPN, proxy or hosting exit. - `geoip.asnOrganization` (and `asn`) when present: a cloud, colocation or hosting provider points to a datacenter; an access or eyeball ISP points to residential. Label that classification as a heuristic and name the evidence you used for it. If no PTR came back and no ASN fields are present, say the evidence is insufficient rather than guessing.

  ConnectorNo auth

• agent_statusA

  MERX - TRON Resource ExchangeB

  Get a snapshot of your agent payment service: registered TRON address, count of pending payment requests (request_payment), active address watches (watch_address), and outstanding invoices (create_invoice). Use this right after register_agent to confirm the agent is set up, or any time you want to see how much in-flight activity your agent has. Auth required (API key) and agent must be registered first via register_agent.

  ConnectorNo auth

• set_primary_domainA

  XRPNameA

  Get the link to set a domain as your wallet's primary (the name shown by default for your address). Setting primary is completed in the browser — the website handles it and your wallet signs there (the MCP does NOT build or broadcast the transaction). Use when the user says "make X.xrp my primary" or "set X.xrpfi as my main domain". The wallet must already own the domain.

  ConnectorNo auth

• validate_emailA

  FabTally ValidA

  PAID $0.002 (x402, USDC on Base). Validate an email address: give {email} and get RFC-ish syntax validation, a LIVE MX-record (DNS) existence check, disposable/throwaway-domain detection (bundled blocklist), and a role-address flag (info@, admin@…). STATELESS and non-PII — the address is never stored and no SMTP mailbox is probed. Without payment returns the x402 challenge; pass x_payment to settle.

  ConnectorNo auth

• mx_lookupA

  UptimeifyA

  Look up a domain's MX records and resolve each mail exchanger to its IPv4 and IPv6 addresses, ordered by priority and flagged when a host resolves into private address space. Tells you where mail for the domain is delivered; it does not connect to those servers, does not test SMTP, and says nothing about whether the domain is authorised to send (spf_check, dkim_check, dmarc_check). Anonymous and rate-limited per IP.

  ConnectorNo auth

• whois_lookupA

  IntoDNS.ai DNS & Email Security ScannerA

  Read-only WHOIS/RDAP lookup for a domain or IP address. For domains it returns registrar, EPP domain-status codes, nameservers, registration/expiry/last-changed dates, and the abuse contact; for IPs it returns the network allocation (CIDR, name, type). Data is sourced live from the IANA RDAP bootstrap with an rdap.org fallback. Registrant personal data is usually GDPR-redacted — that is normal, not an error. Use to check domain ownership, age, or expiry, vet a suspicious domain, or find an abuse contact; for DNS records use lookup_dns instead. `query` is a domain name or an IPv4/IPv6 address. No auth, no side effects.

  ConnectorNo auth

• whois_lookupA

  Name.ai MCP ServerA

  Look up WHOIS/RDAP registration details for a domain: registrar, registrant, creation/expiration dates, nameservers. Backed by POST /api/tools/whois — public, no auth required, but rate limited by name.ai to 10 lookups per day per caller IP. Since every MCP call shares this server's egress IP, that quota is pooled across all of this MCP server's callers, not per end user. Args: domain: A domain name to look up, e.g. "example.com".

  ConnectorNo auth

• pw_snapshotA

  Perimeter WatchA

  Run a free one-time external-perimeter scan on a domain you control. Checks TLS certificate expiry, domain renewal status, dangling CNAME takeover risk, and CT-log lookalike domains. Returns a rating plus per-check detail. NOT idempotent (each call consumes rate limit); takes 20-60s; rate-limited to 3 scans per IP per 24h. Args: domain: the domain to scan (e.g. example.com) authority: MUST be true — attests you or your principal own/manage this domain. Scanning third-party domains without authority is prohibited. Scan takes 20-60s. Rate limit: 3/IP/24h.

  ConnectorNo auth

• set_primary_domainA

  LedivA

  Choose which connected domain is the canonical address of the site. It serves the site and every other connected domain answers 308 to it, keeping the path and the query; the Lediv address keeps working and is left out of search. Needs a paid plan once the domain is out of its grace period; otherwise this is refused with PRO_REQUIRED. Only the owner of a project can do this.

  ConnectorOAuth